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Using This Manual 



This manual is designed to give you an introduction to the HP64147A 
7750/51 Series Emulator. This manual will also help define how these 
emulators differ from other HP 64700 Emulators. 

This manual will: 

■ give you an introduction to using the emulator 

■ explore various ways of applying the emulator to accomplish 
your tasks 

■ show you emulator commands which are specific to the 
7750/51 Series Emulator 

This manual will not: 



tell you how to use each and every emulator/analyzer 
command (refer to the User's Reference manual) 



Organization 

Chapter 1 



An introduction to the HP 64147A 7750/5 1 Series emulator features 
and how they can help you in developing new hardware and software. 



Chapter 2 

Chapter 3 
Chapter 4 

Appendix A 
Appendix B 



A brief introduction to using the HP 64147A 7750/5 1 Series Emulator. 
You will load and execute a short program, and make some 
measurements using the emulation analyzer. 

How to plug the emulator probe into a target system. 

Configuring the emulator to adapt it to your specific measurement 
needs. 



Using a foreground monitor program; advantages and disadvantages. 
HP 64147A 7750/51 Series Emulator Specific Command Syntax 
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Introduction to the 7750/51 Series Emulator 

Introduction The topics in this chapter include: 

■ Purpose of the 7750/51 Series Emulator 

■ Features of the 7750/5 1 Series Emulator 



Purpose of the 
7750/51 Series 
Emulator 



The HP 64147A 7750/51 Series Emulator is designed to replace the 
MELPS 7700/50/5 1 Series microprocessor in your target system so you 
can control operation of the processor in your application hardware 
(usually referred to as the target system). The emulator performs just 
like the MELPS 7700/50/5 1 Series microprocessor, but is a device that 
allows you to control the MELPS 7700/50/51 Series directly. These 
features allow you to easily debug software before any hardware is 
available, and ease the task of integrating hardware and software. 



N Ote | In mis manual, MELPS 7700/50/5 1 Series is referred to as 7750/5 1 

Series. 
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Figure 1-1. HP 64147 Emulator for MELPS 7750/51 Series 
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Supported To emulate processors of 7750/51 Series, you need to purchase 
'OCeSSOTS appropriate emulation pod and/or emulation processor. The HP 64147A 
7750/51 Series emulator is provided with the following items. 

■ HP 64146-61002 emulation pod with M37702S1BFP 
emulation processor 

■ SDIP64 socket 

The HP 64147A 7750/51 Series emulator can emulate M37702M2/4/6, 
M37703M2/4/6, M37702S1/4, M37703S1/4 and M37702M6L 
processors by using default emulation pod, HP 64146-61002. This 
emulation pod can be used with clock up to 25 MHz. 

To emulate other processors by the HP 64147A 7750/51 emulator, you 
need to purchase appropriate emulation pod and/or emulation 
processor. Refer to the Processor Support List for HP MELPS 
emulators to determine if your microprocessor is supported or not. 

The HP 64147A #001 emulator is provided with no emulation pod. 
You need to purchase appropriate emulation pod and emulation 
processor. 

To purchase emulation pod or emulation processor, contact the address 
listed in the manual provided with your emulation pod. 



Features of the This section introduces you to the features of the HP 64147A 7750/51 

"^"750/5"] Series Series emulator. The chapters which follow show you how to use these 

" *" * features. 

Emulator 



ClOCk Speed The HP 64147A 7750/5 1 Series emulator can run with no wait state up 
to 25 MHz. When clock is faster than 16 MHz, you can use the 
emulator with one of the following methods. 

■ Insert one wait state by the RDY signal. The emulator can be 
configured to generate the RDY signal. Also, the emulator 
accepts RDY signal from the target system. 
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■ Use the high speed access mode of the emulator. The emulator 
can run with no wait state up to 25MHz. However, there is a 
limitation in the mapping of the emulation memory in this 
mode. Refer to Chapter 4 of this manual for more detail. 

The HP 64146-61002 emulation pod generate internal clock of 
1/8/16/25 MHz. This emulation pods can be used with target system 
clock from 1 up to 25 MHz. 

Emulation memory The HP 64147A 7750/51 Series emulator is used with one of the 

following Emulation Memory Cards. 

■ HP 64726A 128K byte Emulation Memory Card 

■ HP 64727 A 5 1 2K byte Emulation Memory Card 

■ HP 64728 A 1M byte Emulation Memory Card 

■ HP 64729A 2M byte Emulation Memory Card 

The emulation memory can be configured into 256 byte blocks. A 
maximum of 16 ranges can be configured as emulation RAM (eram), 
emulation ROM (erom), target system RAM (tram), target system 
ROM (trom), or guarded memory (grd). The HP 64147A 7750/51 
Series emulator will attempt to break to the emulation monitor upon 
accessing guarded memory; additionally, you can configure the 
emulator to break to the emulation monitor upon performing a write to 
ROM (which will stop a runaway program). 

Analysis The HP 64147A 7750/5 1 Series emulator is used with one of the 
following analyzers which allows you to trace code execution and 
processor activity. 

■ HP 64706 48-channel Emulation Bus Analyzer 

■ HP 64704 80-channel Emulation Bus Analyzer 

■ HP 64703 64-channel Emulation Bus Analyzer and 
16-channel State/Timing Analyzer 

■ HP 64794A/C/D 80-channel 8K/64K/256K Emulation Bus 
Analyzer 

The Emulation Bus Analyzer monitors the emulation processor using 
an internal analysis bus. The HP 64703 64-channel Emulation Bus 
Analyzer and 16-channel State/Timing Analyzer allows you to probe 
up to 16 different lines in your target system. 
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Foreground or 
Background 
Emulation Monitor 



When you power up the emulator, or when you initialize it, the 
background monitor is used by default. You can also configure the 
emulator to use a foreground monitor. Before the background and 
foreground monitors are described, you should understand the function 
of the emulation monitor program. 



The Function of the Monitor Program 

The monitor program is the interface between the emulation system 
controller and the target system. The emulation system controller uses 
its own microprocessor to accept and execute emulation system, and 
analysis commands. The monitor program is executed by the 
emulation processor. 

The monitor program makes possible emulation commands which 
access target system resources. (The only way to access target system 
resource is through the emulation processor.) For example, when you 
enter a command to modify target system memory, it is the execution 
of monitor program instructions that cause the new values to be written 
to target system memory. 



The Background Monitor 

On emulator power-up, or after initialization, the emulator uses the 
background monitor program. The background monitor does not 
occupy processor address space. 



The Foreground Monitor 

You can configure the emulator to use a foreground monitor program. 
When a foreground monitor is selected it executes in the foreground 
emulator mode. The foreground monitor occupies processor memory 
space and executes as if it were part of your program. 



Reg iSter Display and You can display or modify the 7750/5 1 Series internal register 

Modification contents. This includes the ability to modify the program counter (PC) 
and the program bank register (PG) values so you can control where the 
emulator starts a program run. 
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Single-Step 



When you are using the background monitor, you can direct the 
emulation processor to execute a single instruction or a specified 
number of instructions. 



Breakpoints 
Real Time Operation 

Coverage 
Measurements 

Reset Support 

Watch Dog Timer 

Easy Products 
Upgrades 



You can set the emulator/analyzer interaction so the emulator will 
break to the monitor program when the analyzer finds a specific state or 
states, allowing you to perform post-mortem analysis of the program 
execution. You can also set software breakpoints in your program. 
This feature is realized by inserting BRK instructions into user 
program. Refer to the "Using Software Breakpoints" section of 
"Getting Started" chapter for more information. 

Real-time signifies continuous execution of your program at full rated 
processor speed without interference from the emulator. (Such 
interference occurs when the emulator needs to break to the monitor to 
perform an action you requested, such as displaying target system 
memory.) Emulator features performed in real time include: running 
and analyzer tracing. Emulator features not performed in real time 
include: display or modify of target system memory; load/dump of 
target memory, display or modification of registers, and single step. 

Coverage memory is provided for the processor's external program 
memory space. This memory allows you to perform coverage 
measurements on programs in emulation memory. 

The emulator can be reset from the emulation system under your 
control; or your target system can reset the emulation processor. 

You can configure the emulator to disable the watch dog timer. 



Because the HP 64700 Series development tools contain programmable 
parts, it is possible to reprogram the firmware and some of the 
hardware without disassembling the HP 64700B Card Cage. This 
means that you'll be able to update product firmware, if desired, 
without having to call an HP field representative to your site. 
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Limitations, 
Restrictions 



Clock Speed 

Access to Internal 
RAM 

Trace Internal RAM 
Note ^ 

Step Command to 
Internal RAM 

DMA Support 

Watch Dog Timer in 
Background 

Step Command with 
Foreground Monitor 



Maximum clock speed of HP 64 147 A 7750/51 emulator is 25MHz. 
This emulator does not support any operation with clock faster than 
25MHz. 

Modifying internal RAM or SFR suspends user program execution. 



Read data from the internal RAM or SFR is not traced correctly by the 
emulation analyzer. 



Write data is also not traced correctly, when the following conditions 
are met: 

■ The emulator is used with the M37780/81/82/83/85/95/96 
emulation pod. 

■ The processor is operating in the memory expansion or 
microprocessor mode with 8 bit external bus. 



Step command to internal RAM area is not available. 



Direct memory access to emulation memory is not allowed. 



Watch dog timer suspends count down while the emulator is running in 
background monitor. 



Step command is not available when the emulator is used with a 
foreground monitor. 
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Step Command and 
Interrupts 



When an interrupt occurs while the emulator is running in monitor, the 
emulator fails to do the first step operation. The emulator will display 
the mnemonic of the instruction which should be stepped, but the 
instruction is not actually executed. The second step operation will 
step the first instruction of the interrupt routine. 



Emulation 
Commands in 
Stop/Wait Mode 



When the microprocessor is in the stop or wait mode, emulation 
commands which access memory or registers will fail. In the case of 
using M37782/83/85 emulation pod, you need to reset the emulator to 
release stop or wait mode. And, in the case of using other emulation 
pod, you need to break the the emulator. 



RDY/HOLD Input in 
Background Cycles 



The 64147A M37750/51 emulator does not accept RDY/HOLD input 
while in background monitor. However, when you use 
M37780/8 1/82/83/85/95/96 emulation pod, M37750/51 emulator 
accepts RDY/HOLD input while in background monitor. 



Accessing External When operation mode is memory expansion or microprocessor mode, 
Memory Area in SFR mere i s external memory area in SFR. However, accessing to this area 

is not allowed. 



High Speed BUS Always set bus mode as low speed bus mode, when you use M37751 
Mode emulation pod. HP 64147A 7750/5 1 emulator does not support high 
speed bus mode. Note that bus mode is automatically configured as 
high speed bus mode when you do r rst(run from target reset) 
command. Then, you need to re-configure bus mode as low speed bus 
mode before accessing SFR area. 



RMPA Instruction Disassembling in trace list may not be correct for next instruction of 

RMPA instruction. This failure will occur when RMPA instruction is 
repeated over about fifty times. 



Stack Address in some versions of 7720 microprocessor, the stack can be located in 
Bank FF. However, the HP 64147A 7750/5 1 Series emulator does not 
support the feature. The stack must be located in Bank 0. 



Evaluation Chip Hewlett-Packard makes no warranty of the problem caused by the 

Evaluation chip in the emulator. 
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Getting Started 



Introduction This chapter will lead you through a basic, step by step tutorial that 

shows how to use the HP 64147A emulator for the 7750/51 Series 
microprocessor. When you have completed this chapter, you will be 
able to perform these tasks: 

■ Set up an emulation configuration for out of circuit emulation 
use 

■ Transfer a small program into emulation memory 

■ Use run/stop controls to control operation of your program 

■ Use memory manipulation features to alter the program' s 
operation 

■ Use analyzer commands to view the real time execution of 
your program 
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Before You Begin Before be ginning the tutorial presented in this chapter, you must have 

completed the following tasks: 



1. Completed Hardware installation 

Complete hardware installation of the HP 64700 emulator in 
configuration you intend to use for your work: 

- Standalone configuration 

- Transparent configuration 

- Remote configuration 

References: The HP 64700 Series Installation/Service manual 

2. Connected the emulation pod to the emulator 

Connect the emulation pod to the emulator as shown in Figure 
2-1. 




Figure 2-1. Connecting the Emulation Pod 



Caution 




Turn off power of the emulator before inserting the cable to the 
emulation pod to avoid circuit damage. 
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If you have properly completed steps above, you should be able to hit 
<RETURN> (or <ENTER> on some keyboards) and get a prompt on 
your terminal screen. 

If you do not see any prompt, retrace your steps through the hardware 
and software installation procedures outlined in the manuals above, 
verifying all connections and procedural steps. In any case, you must 
have a command prompt on your terminal screen before proceeding 
with the tutorial. 



A Look at the 
Sample Program 



The sample program "COMMAND_READER" used in this chapter is 
shown Figure 2-2. The program emulates a primitive command 
interpreter. 



Note 




This sample program is written for Mitsubishi RASM77 Assembler. 



Data Declarations 

INPUT_POINTER and OUTPUT_POINTER define the address 
locations of an input area and an output area to be used by the program. 
MESSAGE_A, MESSAGE_B and INVALID_INPUT are the messages 
used by the program to respond to various command inputs. 

Initialization 

First, the INIT routine set up the stack pointer. Next, locations of the 
input area is cleared by the CLEAR_INPUT routines. 

READINPUT 

This routine continuously reads the byte at location 100 hex until it is 
something other than a null character (00 hexadecimal); when this 
occurs, the CLEAR_OUTPUT routine clears the output area, and the 
PROCESS_COMM routine is executed. 
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LDA 


46 


00C02F 


A200D0 


L 




LDX 


47 


00C032 


800C 
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BRA 


48 


00C034 
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C0MMAND_B : 


LDA 


49 


00C036 
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50 


00C039 
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0 
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BUFFER 
100H 

1 

200H 

1 

TABLE 
0D000H 

'THIS IS MESSAGE A' 



'THIS IS MESSAGE B' 



' INVALID COMMAND' 



SAMPPROG 
8 

16 

0C000H 
#27FH 



B, #00H 

B, DT : INPUT_POINTER 
A, DT : INPUT_POINTER 
A, #00H 
READ_INPUT 



X 

#00H 
#20H 

B, DT : 0UTPUT_P0INTER, 



CLEAR_L00P 

16 
X 

A, #41H 

C0MMAND_A 

A, #42H 

C0MMAND_B 

UNRECOGNIZED 

A, #11H 

#MESSAGE_A 

OUTPUT 

A, #11H 

#MESSAGE_B 

OUTPUT 



Figure 2-2. Sample Program Listing (Cont'd) 
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51 
52 
53 
54 
55 
56 
57 



00C03D A222D0 

00C040 A00002 

00C043 540000 

00C046 80BD 



00C03B A90F 



L 
L 



L 



OUTPUT : 



UNRECOGNIZED : 



LDA 
LDX 
LDY 
MVN 
BRA 



A, #0FH 

#INVALID_INPUT 

#OUTPUT_POINTER 

0,0 

CLEAR_INPUT 



.END 



Figure 2-2. Sample Program Listing 
PROCESS_COMM 

Compares the input byte (now something other than a null) to the 
possible command bytes of "A" (ASCII 41 hex) and "B" (ASCII 42 
hex), then jumps to the appropriate set up routine for the command 
message. If the input byte does not match either of these values, a 
branch to a set up routine for an error message is executed. 

COMMAND A, COMMAND B, UNRECOGNIZED 

These routines set up the proper parameters for writing the output 
message: the number of bytes in the message is moved to accumulator 
A and the base address of the message in the data area is moved to 
index register X. 

OUTPUT 

First, the base address of the output area is moved to index 
register Y. Finally, the proper message is written to the output area by 
the MVN instruction. When done, OUTPUT jumps back to 
CLEAR_INPUT and the command monitoring process begins again. 

Using the various features of the emulator, we will show you how to 
load this program into emulation memory, execute it, monitor the 
program's operation with the analyzer, and simulate entry of different 
commands utilizing the memory access commands provided by the HP 
64700 command set. 
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Using the Help 
Facility 



If you need a quick reference to the Terminal Interface syntax, you can 
use the built-in help facilities. For example, to display the top level 
help menu, type: 



R> help 

help - display help information 

help <group> - print help for desired group 

help -s <group> - print short help for desired group 

help <command> - print help for desired command 

help - print this help screen 



-- VALID group NAMES 

gram - system grammar 

proc - processor specific grammar 



sys - system commands 

emul - emulation commands 

hi - highlevel commands (hp internal use only) 

trc - analyzer trace commands 

* - all command groups 



You can type the ? symbol instead of typing help. For example, if you 
want a list of commands in the emul command group, type: 

R> ? emul 

emul - emulation commands 



b 


. .break to monitor 


dump . 


.dump memory 




. . run user code 


be 


. .break condition 


es . . . 


.emulation status 


reg . . 


. . registers 


bp. . . 


. . breakpoints 


io . . . 


. input / output 


rst . . 


. . reset 


cf 


. . configuration 


load . 


. load memory 




. . run at CMB execute 


cim. . 


..copy target image 


m. . . . 


. memory 


s . . . . 


. . step 


cmb . . 


..CMB interaction 


map . . 


.memory mapper 


ser . . 


..search memory 


cov . . 


. . coverage 


mo . . . 


. modes 






cp. . . 


. . copy memory 


mx . . . 


. mx 







To display help information for any command, just type help (or ?) and 
the command name. For example: 

R> help load 
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load - download absolute file into processor memory space 



load 


-i 


load 


-m 


load 


-t 


load 


-S 


load 


-h 


load 


-a 


load 


-e 


load 


-u 


load 


-o 


load 


-s 


load 


-b 


load 


-x 


load 


-q 


load 


-p 


load 


-c 



<f ile> 



download intel hex format 
download motorola S-record format 
download extended tek hex format 
download symbol file 

download hp format (requires transfer protocol) 
reserved for internal hp use 
write only to emulation memory 
write only to target memory 

data received from the non-command source port 
send a character string out the other port 
data sent in binary (valid with -h option) 
data sent in hex ascii (valid with -h option) 
quiet mode 

record ACK/NAK protocol (valid with -imt options) 
data is received from the 64000 . file name format is : 
<f ilename> :<userid>: absolute 



Becoming Familiar 
with the System 
Prompts 



A number of prompts are used by the HP 64700 Series emulators. Each 
of them has a different meaning, and contains information about the 
status of the emulator before and after the commands execute. These 
prompts may seem cryptic at first, but there are two ways you can find 
out what a certain prompt means. 



Using "help proc" to View Prompt Description 

The first way you can find information on the various system prompts 
is to look at the proc help text. 

R>help proc 

— Address format 

Address format is XXXXXX[@i], where XXXXXXX is a 24 bit address. 

Option @i indicates to access internal ram (iram) fresh controller cycle 

read - read hold - bus hold 

write - write fg - foreground 

byte - byte bg - background 

word - word mx - m or x bit 



Emulation Status Characters 



R - 


emulator in reset state 


c 


- no target system clock 


U - 


running user program 


r 


- target system reset active 


M - 


running monitor program 


b 


- no bus cycles 


W - 


waiting for CMB to become ready 


T 


- waiting for target reset 


g - 


bus grant 


7 


- unknown state 



Equates for Analyzer Label stat 



exec 


- instruction execution 


cpu 


- cpu cycle 


fetch 


- program fetch 


dma 


- dma controller cycle 


data 


- data access 


ref 


- refresh controller cycle 


read 


- read 


hold 


- bus hold 


write 


- write 


fg 


- foreground 


byte 


- byte 


bg 


- background 


word 


- word 


mx 


- m or x bit 
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Using the Emulation Status Command (es) for Description 
of Current Prompt 

When using the emulator, you will notice that the prompt changes after 
entering certain commands. If you are not familiar with a new prompt 
and would like information about that prompt only, enter the es 
(emulation status) command for more information about the current 
status. 

U>es 

M37750/51 — Running user program 



Initializing the If you plan to follow this tutorial by entering commands on your 

Emulator emulator as shown in this chapter, verify that no one else is using the 

emulator. To initialize the emulator, enter the following command: 

R>init 

# Limited initialization completed 

The init command with no options causes a limited initialization, also 
known as a warm start initialization. Warm start initialization does not 
affect system configuration. However, the init command will reset 
emulator and analyzer configurations. The init command: 

■ Resets the memory map. 

■ Resets the emulator configuration items. 

■ Resets the break conditions. 

■ Clears software breakpoints. 
The init command does not: 

■ Clear any macros. 

■ Clear any emulation memory locations; mapper terms are 
deleted, but if you respecify the same mapper terms, you will 
find that the emulation memory contents are the same. 
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Set Up the Proper 

Emulation 

Configuration 

Set Up Emulation To set the emulator's configuration values to the proper state for this 
Conditions tutorial, do this: 

1. Type: 
R> cf 

You should see the following configuration items displayed: 

cf chip=7702M2 

cf isfr=0 . . 07f 

cf iram=080 . . 27f 

cf irom=0c000 . . Of f f f 

cf ipmr=05e 

cf mode=single 

cf mon=bg 

cf clk=int 

cf int=en 

cf rdy=dis 

cf rush=dis 

cf wdog=dis 

cf rsp=27f 

cf rrt=dis 

cf dmdt=dis 

cf tdma=dis 

cf trfsh=dis 

cf thold=dis 



Note MS* Th e individual configuration items won't be explained in this example; 

refer to Chapter 4 of this manual and the User's Reference manual for 
details. 



2. You need to select chip you emulate. You can select chip with 
the following command: 
R> cf chip=<chip_name> 
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You must enter appropriate <chip_name> to your processor. 
Valid <chip_name> are listed in Processor Support List for 
HP MELPS emulators. The default <chip_name> 7702M2 is 
applied to M37702M2 and M37703M2 processors. 



Note Ma Refer to the Processor Support List for HP MELPS emulators to know 

W chip name and support processors. If you would like to know whether 
your microprocessor is supported or not in latest version of Terminal 
Interface, contact your local HP sales representative. 



3. Now, set up reset value for the stack pointer. 
R> cf rsp=27f 



Note 




Without a stack pointer, the emulator is unable to make the transition to 
the run state, step, or perform many other emulation functions. 



4. Let's go ahead and set up the proper break conditions . 
Type: 
R> be 

You will see: 

-d bp #disable 
-d rom #disable 
-d bnct #disable 
-d cmbt tdisable 
-d trigl tdisable 
-d trig2 #disable 

For each break condition that does not match the one listed, 
use one of the following commands: 



0 
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R> 



R> 



d bp tdisable 
e rom #enable 
d bnct tdisable 
d cmbt Idisable 
e trigl #enable 
e trig2 #enable 



R> 



R> 



5. 



R> 



To enable break conditions that are currently disabled, type: 
be -e <breakpoint type> 

To disable break conditions that are currently enabled, type: 
be -d <breakpoint type> 

For example, if typing be gives the following list of break 
conditions: 



(items in bold indicate improper values for this example) 

Type the following commands to set the break conditions 
correctly for this example: 
be -d rom 

(this enables the write to ROM break) 
be -d trigl trig2 

(this disables break on triggers from the analyzer) 

To avoid problems later while modifying and displaying 
memory locations, type: 
mo -ab -db 

This sets the access and display mode for memory operation 
byte. 
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Map Memory 



The emulation memory can be configured as you desire. You can 
define emulation memory as emulation RAM, emulation ROM, target 
RAM, target ROM or guarded memory. 



We will use the default mapping for this sample program. To see the 
default mapping, type: 

R> map 

You will see similar display to the following: 

# remaining number of terms : 15 

# remaining emulation memory : lb800h bytes 
map OOOcOOO . . OOOf f f f erom ' # term 1 

map other tram 



You don't have to map the internal RAM area, since the emulator uses 
the internal RAM of emulation processor to perform emulation. If your 
processor has no internal RAM, map address 100 hex through 2ff hex 
with the following command for this tutorial. 
R> map 100.. 2ff eram 



Note 



4 
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Transfer Code 
into Emulation 
Memory 



From a Terminal in 
Standalone 
Configuration 



To transfer code into emulation memory from a data terminal running 
in standalone mode, you must use the modify memory commands. 
This is necessary because you have no host computer transfer facilities 
to automatically download the code for you (as if you would if you 
were using the transparent configuration or the remote configuration.) 
To minimize the effects of typing errors, you will modify only one row 
of memory at a time in this example. Do the following: 

Enter the data information for the program by typing the following 
commands: 

R> m OdOOO. .0d00f=54,48,49,53,20,49,53,20,4d,45,53,53,41,47,45,20 
R> m OdOlO. .0d01f=41,54,48,49,53,20,49,53,20,4d,45,53,53,41,47,45 
R> m 0d020. . 0d02f =20 , 42 , 49, 4e, 56 , 41 , 4c, 49, 44 , 20 , 43 , 4f , 4d, 4d, 41 , 4e 
R> m 0d030=44 

You could also type the following line instead: 

R> m 0d000="THIS IS MESSAGE ATHIS IS MESSAGE BINVALID COMMAND" 

You should now verify that the data area of the program is correct by 
typing: 

R> m OdOOO . . 0d030 

You should see: 

OOOdOOO . . OOOdOOf 54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 20 
OOOdOlO . . OOOdOlf 41 54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 
000d020 . . 000d02f 20 42 49 4e 56 41 4c 49 44 20 43 4f 4d 4d 41 4e 
000d030 . . 000d030 44 

If this is not correct, you can correct the errors by re-entering only the 
modify memory commands for the particular rows of memory that are 
wrong. 

For example,if row dOOCdOOf shows these values: 

OOOdOOO .. OOOdOOf 54 48 49 53 20 20 49 53 20 4d 45 53 53 41 47 45 
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you can correct this row of memory by typing: 

R> m OdOOO. .0d00f=54,48,49,53,20,49,53,20,4d,45,53,53,41,47,45,20 

Or, you might need to modify only one location, as in the instance 
where address dOOf equals 22 hex rather than 20 hex. Type: 

R> m 0d00f=20 

Enter the program information by typing the following commands: 



R> m OcOOO. . 0c00f=0a2, 7f , 02, 9a, Of 8, 42, 0a9, 00, 42, 8d, 00, 01, Oad, 00, 01, 0c9 
R> m OcOlO. . 0c01f=00, OfO, Of 9, 0e2 , 10 , 0a2 , 00 , OaO , 20 , 42 , 09d, 00 , 02 , 0e8 , 88 , OdO 
R> m 0c020. . 0c02f=0f8, 0c2, 10, 0c9, 41, OfO, 06, 0c9, 42, OfO, 09, 80, Oe, 0a9, 11, 0a2 
R> m 0c030 . . 0c03f=00, OdO, 80, Oc, 0a9, 11, 0a2, 11, OdO, 80, 05, 0a9, Of, 0a2, 22, OdO 
R> m 0c040. .0c047=0a0,00,02,54,00,00,80,0bd 



(note the hex letters must be preceded by a digit) 

You should now verify that the program area is correct by typing: 
R> m OcOOO . . 0c047 



OOOcOOO . . OOOcOOf a2 7f 

OOOcOlO . . OOOcOlf 00 f 0 

000c020 . . 000c02f f 8 c2 

000c030 . . 000c03f 00 dO 

000c040 . . 000c047 aO 00 



You should see: 

02 9a f8 42 a9 00 42 

f9 e2 10 a2 00 aO 20 

10 c9 41 fO 06 c9 42 

80 Oc a9 11 a2 11 dO 

02 54 00 00 80 bd 



8d 00 01 ad 00 01 c9 

42 9d 00 02 e8 88 dO 

fO 09 80 Oe a9 11 a2 

80 05 a9 Of a2 22 dO 



If this is not correct, you can correct the errors by re-entering only the 
modify memory commands for the particular rows of memory that are 
wrong. 



Transparent 
Configuration 



login : 
login : 
login : 



If your emulator is connected between a terminal and a host computer, 
you can down load programs into memory using the load command 
with the -o (from other port) option. 

First, you must establish communications with your host computer 
through the transparent mode link provided in the HP 64700. Type: 

R> xp -e 

If you then press <RETURN> a few times, you should see: 
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This is the login prompt for an HP-UX host system. (Your prompt may 
differ depending on how your system manager has configured your 
system.) Log in to your host system. Disable the transparent mode so 
that your terminal will talk directly to the emulator. Type: 

S <ESC>g xp -d 

The "<ESC>g" sequence temporarily toggles the transparent mode so 
that the emulator will accept commands; "xp -d" then fully disables the 
transparent mode. 

The succeeding procedure is different depending on the format you 
yare going to download. 



HP Absolute 

If you have a Softkey Interface, a file format converter is provided with 
it. The converter can convert MELPS 7700 Hex format files into HP 
Absolute files. (Refer to the Softkey Interface User's Guide for more 
details.) Downloading the HP Absolute requires the transfer protocol. 
The example below assumes that the transfer utility has been installed 
on the HP 9000/700 host computer. 

R> load -hbo <RETURN> 
transfer -rtb cmd_rds.X <ESC>g 
########## 
R> 



Intel Hex format 

The example which follow shows how to download the Intel 
hexadecimal files. 

R> load -io <RETURN> 
cat cmd_rds . hex<ESC>g 
########### 

Data records received = 00009 
R> 



Note Ha The emulator can load the MELPS 7700 Hex format files with 

load -i command when the program is located address fffff hex or less. 
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At this point you should examine a portion of memory to verify that 
your code was loaded correctly. 



Type: 

R> m OcOOO . . 0c047 



You should see: 



OOOcOOO . 


. OOOcOOf 


a2 


7f 


02 


9a 


f 8 


42 


a9 


00 


42 


8d 


00 


01 


ad 


00 


01 


c9 


OOOcOlO . 


. OOOcOlf 


00 


f 0 


f 9 


e2 


10 


a2 


00 


aO 


20 


42 


9d 


00 


02 


e8 


88 


dO 


000c020 . 


. 000c02f 


f 8 


c2 


10 


c9 


41 


fO 


06 


c9 


42 


fO 


06 


80 


Oe 


a9 


11 


a2 


000c030. 


. 000c03f 


00 


dO 


80 


0c 


a9 


11 


a2 


11 


dO 


80 


05 


a9 


Of 


a2 


22 


dO 


000c040 . 


. 000c047 


aO 


00 


02 


54 


00 


00 


80 


bd 
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Now that you have loaded your code into emulation memory, you can 
display it in mnemonic format. Before displaying memory in 
mnemonic format, you need to tell the emulator what value of M flag 
and X flag should be used to disassemble the memory contents. This is 
needed because the length of operand is variable according to M flag 
and X flag. Type: 

R> mx -mO -xO 

To display memory in mnemonic format, type: 
R> m -dm 0c000..0c047 



You will see: 



OOOcOOO - 


LDX 


#027fH 


000c003 - 


TXS 




000c004 - 


SEM 




000c005 - 


LDA 


B, #00H 


000c008 - 


STA 


B, DT : 0100H 


OOOcOOc - 


LDA 


A, DT : 0100H 


OOOcOOf - 


CMP 


A, #00H 


OOOcOll - 


BEQ 


OOcOOcH 


000c013 - 


SEP 


#10H 


000c015 - 


LDX 


#00H 


000c017 - 


LDY 


#20H 


000c019 - 


STA 


B, DT : 0200H, X 


OOOcOld - 


INX 




OOOcOle - 


DEY 




OOOcOlf - 


BNE 


00c019H 


000c021 - 


CLP 


#10H 


000c023 - 


CMP 


A, #41H 


000c025 - 


BEQ 


00c02dH 


000c027 - 


CMP 


A, #42H 


000c029 - 


BEQ 


00c034H 


000c02b - 


BRA 


00c03bH 


000c02d - 


LDA 


A, #11H 


000c02f - 


LDX 


tdOOOH 


000c032 - 


BRA 


00c040H 


000c034 - 


LDA 


A, #11H 


000c036 - 


LDX 


#d011H 


000c039 - 


BRA 


00c040H 


000c03b - 


LDA 


A, #0fH 


000c03d - 


LDX 


#d022H 


000c040 - 


LDY 


#0200H 


000c043 - 


MVN 


00H, 00H 


000c046 - 


BRA 


00c005H 



Looking at Your 
Code 
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When the inverse assembler encounters the following instruction, the 
mx command is set up automatically. 

■ SEM 

■ CLM 

■ SEPX 

■ CLPX 

■ SEPM 

■ CLPM 

In the above example, the mx command is set up as following: 

■ SEM (0c004) mx -ml -xO 

■ SEPX(0c013)mx-ml-xl 

■ CLPX(0c021)mx-ml-x0 

When you display memory in mnemonic format without specifying the 
mx command, the last setting is used to disassemble the memory 
contents. Type: 

R> m 0c015 . . 0c02f 



000c015 - LDX #a000H 

000c018 - JSR PG:9d42H 

OOOcOlb - BRK 

OOOcOld - INX 

OOOcOle - DEY 

OOOcOlf - BNE 00c019H 

000c021 - CLP #10H 

000c023 - CMP A, #41H 

000c025 - BEQ 00c02dH 

000c027 - CMP A, #42H 

000c029 - BEQ 00c034H 

000c02b - BRA 00c03bH 

000c02d - LDA A, #11H 

000c02f - LDX tdOOOH 



As you can see, the memory contents is not disassembled correctly. To 
see the correct mnemonic, set up the mx command: 

R> mx -xl 

R> m 0c015 . . 0c02f 
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000c015 - 


LDX 


#00H 


000c017 - 


LDY 


#20H 


000c019 - 


STA 


B, DT : 0200H, X 


OOOcOld - 


INX 




OOOcOle - 


DEY 




OOOcOlf - 


BNE 


00c019H 


OOOc021 - 


CLP 


#10H 


000c023 - 


CMP 


A, #41H 


000c025 - 


BEQ 


00c02dH 


000c027 - 


CMP 


A, #42H 


000c029 - 


BEQ 


00c034H 


000c02b - 


BRA 


00c03bH 


OOOc02d - 


LDA 


A, #11H 


000c02f - 


LDX 


tdOOOH 



Familiarize 
Yourself with the 
System Prompts 



Note 




The following steps are not intended to be complete explanations of 
each command; the information is only provided to give you some idea 



of the meanings of the various command prompts you may see and 
reasons why the prompt changes as you execute various commands. 



You should gain some familiarity with the HP 64700 emulator 
command prompts by doing the following: 

Ignore the current command prompt. Type: 
*> rst 

You will see: 

R> 

The rst command resets the emulation processor and holds it in the 
reset state. The "R>" prompt indicates that the processor is reset. 
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Type : 

R> r OcOOO 

You will see: 

U> 

The r command runs the processor. 

Type: 
U> b 

You will see: 

M> 

The b command causes the emulation processor to "break" execution of 
whatever it was doing and begin executing within the emulation 
monitor. The "M>" prompt indicates that the emulator is running in the 
monitor. 



Running the 
Sample Program 



4 



Type: 

M> r OcOOO 

The emulator changes state from background to foreground and begins 
running the sample program from location OcOOO hex. 



Note The default number base for address and data values within HP 64700 

is hexadecimal. Other number bases may be specified. Refer to the HP 
64700 User's Reference manual for further details. 
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Let's look at the registers to verify that the stack pointer was properly 
initialized. Type: 

U> reg 
You will see: 

reg pg=00 pc=c00c ps=0023 dt=00 sp=027f a=ff00 b=0000 x=027f y=0017 dpr=0000 

Notice that sp contains 27f hex. 

Verify that the input area command byte was cleared during 
initialization. 

Type: 

U> m -db 100 

You will see: 

0000100. .0000100 00 

The input byte location was successfully cleared. 

Now we will use the emulator features to make the program work. 
Remember that the program writes specific messages to the output area 
depending on what the input byte location contains. Type: 

U> m 100=41 

This modifies the input byte location to the hex value for an ASCII 
"A". Now let's check the output area for a message. 

U> m 200. .21f 

You will see: 

0000200 .. 000020f 54 48 49 53 20 49 53 20 4d 45 53 53 41 47 45 20 
0000210. .000021f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

These are the ASCII values for MESSAGE_A. 

Repeat the last two commands twice. The first time, use 42 instead of 
41 at location 100 and note that MESSAGE_B overwrites 
MESSAGE_A. Then try these again, using any number except 00, 41, 
or 42 and note that the INVALIDJNPUT message is written to this 
area. 
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Note Ha When you modify/display internal RAM or SFR, the emulator breaks 

™ into the monitor, and the monitor program reads the contents of 

memory. This is because the emulator uses internal RAM and SFR of 
emulation processor to perform emulation. Note that user program 
execution is suspended to modify/diplay internal RAM or SFR. 



Note Ma You can configure the emulator so that data write cycles are performed 

to both internal RAM (or SFR) and emulation memory. In this case, 
you can display the data written to emulation memory without 
suspending user program execution. Refer to chapter 4 of this manual 
for more details. 



Stepping Through You can also direct the emulator processor to execute one instruction or 
th© PfOg ram number of instructions. Type: 

M> s 1 0c000;reg 

This command steps 1 instruction from address OcOOO hex, and 
displays registers. You will see: 

OOOcOOO - LDX #027fH 
PC = 000c003 

reg pg=00 pc=c003 ps=0021 dt=00 sp=027f a=ff00 b=0000 x=027f y=0021 dpr=0000 

To step one instruction from present PC, you only need to type s at 
prompt. Type: 

M> s ; reg 
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You will see: 

000c003 - TXS 
PC = 000c004 

reg pg=00 pc=c004 ps=0021 dt=00 sp=027f a=ff00 b=0000 x=027f y=0021 dpr=0000 



When the you use the s command, the disassembled mnemonic 
displayed may not be accurate. You need to set up mx command 
before using the s command to see the correct mnemonic. 



When the emulator performs single step execution with s command, all 
memory access is performed by byte access. 



Easy Command 
Entry 

Using Macros Suppose you want to continue stepping through the program, 

displaying registers after each step. You could continue entering "s" 
commands followed by "reg" commands, but you may find this 
tiresome. It is easier to use a macro to perform a sequence of 
commands which will be entered again and again. 

Macros allow you to combine and store commands. For example, to 
define a macro which will display registers after every step, enter the 
following command. 

M> mac st={s;reg} 

Once the "st" macro has been defined, you can use it as you would any 
other command. 

M> st 

000c004 - SEM 
PC = 000c005 

reg pg=00 pc=c005 ps=0021 dt=00 sp=027f a=ff00 b=0000 x=027f y=0021 dpr=0000 



Note 



4 



Note 



4 
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Command Recall The command recall feature is yet another, easier way to enter 

commands again and again. You can press <CTRL>-r to recall the 
commands which have just been entered. If you go past the command 
of interest, you can press <CTRL>-b to move forward through the list 
of saved commands. To continue stepping through the sample 
program, you could repeatedly press <CTRL>-r to recall and 
<RETURN> to execute the "st" macro. 



Tracing Program 
Execution 



Note 



4 



For this example, you will be using the analyzer in the easy 
configuration, which simplifies the process of analyzer measurement 
setup. The complex configuration allows more powerful measurements, 
but requires more interaction from you to set up those measurements. 
For more information on easy and complex analyzer configurations and 
the analyzer, refer to the HP 64700 Analyzer User's Guide and the 
User's Reference manual. 



Now let's use the emulation analyzer to trace execution of the program. 
Suppose that you would like to start the trace when the analyzer begins 
writing data to the message output area. You can do this by specifying 
analyzer trigger upon encountering write status to address 200 hex. 
Furthermore, you might want to store only the data written to the 
output area. This can be accomplished by modifying what is known as 
the "analyzer storage specification". 

Now let's set the trigger specification. Type: 
M> tg addr=200 and stat=write 

To store only the accesses to the address range 200 hex through 21f 
hex, type: 

M> tsto addr=200 . .21f 
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Emulation trace started 



Let's change the data format of the trace display so that you will see the 
output message writes displayed in ASCII format: 

M> tf addr,h data, a mne count, r seq 

Start the trace by typing: 
M> t 

You will see: 

To start the emulation run, type: 
M> r OcOOO 

Now, you need to have a "command" input to the program so that the 
program will jump to the output routines (otherwise the trigger will not 
be found, since the program will never access address 200 hex). Type: 

U> m 100=41 

To display the trace list, type: 
U> tl 0. .10 



You will see: 



Line 


addr, H 


data, A M37750/51 Mnemonic, H 




count , R 


0 


000200 


xxOOH 


data 


write 


mx 






1 


000201 


OOxxH 


data 


write 


mx 


56 


00 uS 


2 


000202 


xxOOH 


data 


write 


mx 


56 


00 uS 


3 


000203 


OOxxH 


data 


write 


mx 


56 


00 uS 


4 


000204 


xxOOH 


data 


write 


mx 


56 


00 uS 


5 


000205 


OOxxH 


data 


write 


mx 


56 


00 uS 


6 


000206 


xxOOH 


data 


write 


mx 


56 


00 uS 


7 


000207 


OOxxH 


data 


write 


mx 


56 


00 uS 


8 


000208 


xxOOH 


data 


write 


mx 


56 


00 uS 


9 


000209 


OOxxH 


data 


write 


mx 


56 


00 uS 


10 


00020a 


xxOOH 


data 


write 


mx 


56 


00 uS 



seq 



The above list shows the execution of the CLEAR_OUTPUT routine 
which cleared the output area. To see the states that the program wrote 
the message to the output area, type: 

U> tl 30. .40 
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Line 



addr,H data, A M37750/51 Mnemonic, H 



count, R seq 



30 


00021e 




31 


00021f 




32 


000200 


HT 


33 


000202 


SI 


34 


000204 


I . 


35 


000206 


. S 


36 


000208 


EM 


37 


00020a 


SS 


38 


00020c 


GA 


39 


00020e 


. E 


40 







xxOOH 


data 


write 


OOxxH 


data 


write 


4854H 


data 


write 


5349H 


data 


write 


4920H 


data 


write 


2053H 


data 


write 


454dH 


data 


write 


5353H 


data 


write 


4741H 


data 


write 


2045H 


data 


write 



mx 56.00 uS 

mx 56.00 uS 

mx 134.0 uS 

mx 18.00 uS 

mx 18.00 uS 

mx 18.00 uS 

mx 18.00 uS 

mx 18.00 uS 

mx 18.00 uS 

mx 18.00 uS 



Emulation trace halted 



If you look at the last lines of the trace listing, you will notice that the 
analyzer seems to have stored only part of the output message, even 
though you specified more than the full range needed to store all of the 
message. The reason for this is that the analyzer has a storage pipeline, 
which holds states that have been acquired but not yet written to trace 
memory. To see all of the states, halt the analyzer by typing: 

U> th 
You will see: 



Now display the trace list: 
U> tl 30. .40 



You will see: 



Line 


addr, H 


data, A 


M37750/51 Mnemonic, H 




count , R 


30 


00021e 




xxOOH 


data 


write 


mx 


56 


. 00 uS 


31 


00021f 




OOxxH 


data 


write 


mx 


56 


. 00 uS 


32 


000200 


HT 


4854H 


data 


write 


mx 


13 


4 . 0 uS 


33 


000202 


SI 


5349H 


data 


write 


mx 


18 


.00 uS 


34 


000204 


I . 


4920H 


data 


write 


mx 


18 


.00 uS 


35 


000206 


. S 


2053H 


data 


write 


mx 


18 


. 00 uS 


36 


000208 


EM 


454dH 


data 


write 


mx 


18 


.00 uS 


37 


00020a 


SS 


5353H 


data 


write 


mx 


18 


.00 uS 


38 


00020c 


GA 


4741H 


data 


write 


mx 


18 


.00 uS 


39 


00020e 


.E 


2045H 


data 


write 


mx 


18 


.00 uS 


40 


000210 


TA 


xx41H 


data 


write 


mx 


16 


.00 uS 



seq 



As you can see, all of the requested states have been captured by the 
analyzer. 
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Predefined Status Equates 



### Equates ### 
equ bg=Oxlxxxxxxy 
equ byte=Oxxlxlxlxy 
equ cpu=Oxxl lxxxxy 
equ data=OxxlxlOxxy 
equ dma=OxxlOxxxxy 
equ exec=0xxll01xxy 
equ f etch=Oxxllllxly 
equ f g=OxOxxxxxxy 
equ hold=0xx01xxxxy 
equ mx=lxxxxxxxy 
equ read=Oxxlxlxxly 
equ ref =OxxOOxxxxy 
equ word=OxxlxlxOxy 
equ write=OxxlxlxxOy 



Common values for the status trace signals have been predefined. One 
of these equates "write" was used in the above example. You can see 
these equates with the following command. 

U> equ 



Using Software 
Breakpoints 



You can stop program execution at specific address by using bp 
(software breakpoint) command. When you define a software 
breakpoint to a certain address, the emulator will replace the opcode 
with BRK instruction as software breakpoint instruction. When the 
emulator detects the BRK instruction, user program breaks to the 
monitor, and the original opcode will be placed at the breakpoint 
address. A subsequent run or step command will execute from this 
address. 

If the BRK instruction was not inserted as the result of bp command (in 
other words, it is part of the user program), the "Undefined software 
breakpoint" message is displayed. 



Note You can set software breakpoints only at memory locations which 

contain instruction opcodes (not operands or data). If a software 
breakpoint is set at a memory location which is not an instruction 
opcode, the software breakpoint instruction will never be executed and 
the break will never occur. 
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Note Ha Because software breakpoints are implemented by replacing opcodes 

™ with the software breakpoint instruction, you cannot define software 

breakpoints in target ROM. You can, however, copy target ROM into 
emulation memory by cim command when you are using the 
background monitor. (Refer to HP 64700 Terminal Interface User's 
Reference manual.) 



Note 




When internal RAM is mapped as emulation memory, defining 



software breakpoints in this area is not allowed. 



Displaying and 
Modifying the Break 
Conditions 



be -d bp tdisable 
be -d rom #disable 
be -d bnct tdisable 
be -d cmbt tdisable 
be -d trigl tdisable 
be -d trig2 tdisable 



Before you can define software breakpoints, you must enable software 
breakpoints with the be (break conditions) command. To view the 
default break conditions and change the software breakpoint condition, 
enter the following commands. 

M> be 



M> be -e bp 



Defining a Software 
Breakpoint 



Now that the software breakpoint is enabled, you can define software 
breakpoints. Enter the following command to break on the address of 
the OUTPUT label. 

M> bp 0c040 

Run the program and verify that execution broke at the appropriate 
address. 



M> r OcOOO 
U> m 100=41 

!ASYNC_STAT 615! Software break point: 000c040 
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M> reg 

reg pg=00 pc=c040 ps=00al dt=00 sp=027f a=0011 b=0000 x=dOOO y=0000 dpr=0000 

Notice that PC contains c040. 

When a breakpoint is hit, it becomes disabled. You can use the -e 
option to the bp command to reenable the software breakpoint. 

M> bp 

###BREAKPOINT FEATURE IS ENABLED### 
bp 000c040 #disabled 

M> bp -e 0c040 

M> bp 

###BREAKPOINT FEATURE IS ENABLED### 
bp 000c040 #enabled 

M> r OcOOO 
U> m 100=41 

!ASYNC_STAT 615! Software breakpoint: 000c040 

M> bp 

###BREAKPOINT FEATURE IS ENABLED### 
bp 000c040 #disabled 



Searching 
Memory for 
Strings or 
Numeric 
Expressions 



The HP 64700 Emulator provides you with tools that allow you to 
search memory for data strings or numeric expressions. For example, 
you might want to know exactly where a string is loaded. To locate the 
position of the string "THIS IS MESSAGE A" in the sample program. 
Type: 



M> ser OcOOO .. Odfff="THIS IS MESSAGE A" 



pattern match at address: OOOdOOO 



You can also find numeric expressions. For example, you might want 
to find all of the BEQ instructions in the sample program. Since a BEQ 
instruction begins with fO hex, you can search for that value by typing: 
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M> ser -db OcOOO . . 0c047=0f 0 



pattern 
pattern 
pattern 



match at 
match at 
match at 



address : 
address : 
address : 



OOOcOll 
000c025 
000c029 



Making Program 

Coverage 

Measurements 



In testing your program, you will often want to verify that all possible 
code segments are executed. With the sample program, we might want 
to verify that all of the code is executed if a command "A", command 
"B", and an unrecognized command are input to the program. 



To make this measurement, we must first reset the coverage status. 
M> cov -r 



Note Ma You should always reset the coverage status before making a coverage 

™ measurement. Any emulator system command which accesses 

emulation memory will affect the coverage status bit, resulting in 
measurement errors if the coverage status is not reset. 



Now, run the program and input the following commands: 

M> r OcOOO 

U> cov OcOOO.. 0c047 

percentage of memory accessed: % 30.6 

U> m 100=41 

U> cov OcOOO.. 0c047 

percentage of memory accessed: % 81.9 

U> m 100=42 
U> m 100=43 
U> cov OcOOO . . 0c047 

percentage of memory accessed: % 100.0 
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Trace Analysis 
Considerations 



Restriction of the 
Analyzer 



There is a restriction on the function of the emulation analyzer. It 
cannot trace the data which is read from internal RAM or SFR area. 
Such data always appears ff hex in the trace listing. This is because the 
emulator uses the internal RAM and SFR of emulation processor to 
perform emulation. Data read from internal RAM or SFR doesn't 
appear on the analyzer data bus. 

As an example, trace the accesses to the INPUT_POINTER. 

To initialize the analyzer, type: 
U> tinit 

Set up the trigger condition and perform the trace: 

U> tg addr=0c00c and stat=exec 

u> t 

U> tl 0. .20 



Line 


addr, H 


M7750/51 Mnemonic, H 




count , R 


0 


OOcOOc 


LDA 


A, DT : 0100H 




2 


000 


uS 


1 


OOcOOe 




c901H opcode fetch 


mx 


6 


000 


uS 


2 


000100 




xxffH data read 


mx 


4 


000 


uS 


3 


OOcOOf 


CMP 


A, #00H 




2 


000 


uS 


4 


OOcOlO 




fOOOH opcode fetch 


mx 


6 


000 


uS 


5 


OOcOll 


BEQ 


OOcOOcH 




2 


000 


uS 


6 


00c012 




e2f9H opcode fetch 




6 


000 


uS 


7 


00c014 




a210H opcode fetch 




8 


000 


uS 


8 


OOcOOc 




OOadH opcode fetch 




8 


000 


uS 


9 


OOcOOc 


LDA 


A, DT : 0100H 




2 


000 


uS 


10 


OOcOOe 




c901H opcode fetch 


mx 


6 


000 


uS 


11 


000100 




xxffH data read 


mx 


4 


000 


uS 


12 


OOcOOf 


CMP 


A, #00H 




2 


000 


uS 


13 


OOcOlO 




fOOOH opcode fetch 


mx 


6 


000 


uS 


14 


OOcOll 


BEQ 


OOcOOcH 




2 


000 


uS 


15 


00c012 




e2f9H opcode fetch 




6 


000 


uS 


16 


00c014 




a210H opcode fetch 




8 


000 


uS 


17 


OOcOOc 




OOadH opcode fetch 




8 


000 


uS 


18 


OOcOOc 


LDA 


A, DT : 0100H 




2 


000 


uS 


19 


OOcOOe 




c901H opcode fetch 


mx 


6 


000 


uS 


20 


000100 




xxffH data read 


mx 


4 


000 


uS 



seq 



As you can see in line 2 of the listing above, data read from internal 
RAM (which should be 00 hex) appears ff hex. 
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Notes 
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Using the 7750/51 Series Emulator In-Circuit 



When you are ready to use the HP 64 147 A 7750/51 Series Emulator in 
conjunction with actual target system hardware, there are some special 
considerations you should keep in mind. 

■ installing the emulator probe 

■ properly configure the emulator 

We will cover the first topic in this chapter. For complete details on 
in-circuit emulation configuration, refer to Chapter 4. 
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Installing the 
Target System 
Probe 



Caution H Th e following precautions should be taken while using the HP 64147A 

7750/51 Series Emulator. Damage to the emulator circuitry may result 
if these precautions are not observed. 

Power Down Target System. Turn off power to the user target system 
and to the HP 64147A 7750/51 Series Emulator before inserting the 
user plug to avoid circuit damage resulting from voltage transients or 
mis-insertion of the user plug. 

Verify User Plug Orientation. Make certain that Pin 1 of the target 
system microprocessor socket and Pin 1 of the user plug are properly 
aligned before inserting the user plug in the socket. Failure to do so 
may result in damage to the emulator circuitry. 

Protect Against Static Discharge. The HP 64147A 7750/5 1 Series 
Emulator contains devices which are susceptible to damage by static 
discharge. Therefore, operators should take precautionary measures 
before handling the user plug to avoid emulator damage. 



Caution H You target system must have a clock generation circuit. The emulation 

™ pod cannot generate clock signal using a ceramic (or quartz crystal) 
resonator. 
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Installing the Target 

System Probe 1. Set up the switches inside the emulation pod. When you are 

using the HP 64146-61002 emulation pod, refer to the 7750/51 
Series Emulation Pod User's Guide. When you are using an 
other emulation pod, refer to the manual provided with your 
emulation pod. 

2. Remove the 7750/5 1 Series microprocessor from the target 
system socket. Note the location of pin 1 on the processor and 
on the target system socket. 



3. Store the microprocessor in a protected environment (such as 
antistatic foam). 



4. Install the target system probe into the target system 
microprocessor socket. (See figure 3-1.) 

5. Turn on power of your target system, and then, turn on the 
emulator. 
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When your target system uses 64 pin shrink DIP socket, use the adapter 
as shown in figure 3-2. 




Figure 3-2. Installing the Probe to SDIP64 Socket 
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Running the 
Emulation from 
Target Reset 



You can specify that the 7750/5 1 emulator begins execution from target 
system reset. To specify a run from target system reset, enter the 
following command: 



R>r rst 

Now, you can see T> system prompt. When the target system RESET 
line becomes active and then inactive, the 7750/5 1 emulator will start 
reset sequence as actual microprocessor. 



Note I n me "Awaiting target reset" status(T>), you can not break into the 

monitor. If you want to exit this status, you need to enter rst command. 
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Configuring the 7750/51 Series Emulator 



In this chapter, we will discuss: 

■ how to configure the HP 64700 emulator for 7750/5 1 Series 
microprocessor to fit your particular measurement needs. 

■ some restrictions of HP 64700 emulator for 7750/5 1 Series 
microprocessor. 



Types of Emulator 
Configuration 

Emulation Processor 
to Emulator/Target 
System 



These are the commands which are generally thought of as 
"configuration" items in the context of other HP 64000 emulator 
systems. The commands in this group set up the relationships between 
the emulation processor and the target system, such as determining how 
the emulator responds to requests for the processor bus. Also, these 
commands determine how the emulation processor interacts with the 
emulator itself; memory mapping and the emulator's response to 
certain processor actions are some of the items which can be configured. 

These commands are the ones which are covered in this chapter. 



Commands Which 
Perform an Action or 
Measurement 



Several of the emulator commands do not configure the emulator; they 
simply start an emulator program run or other measurement, begin or 
halt an analyzer measurement, or allow you to display the results of 
such measurements. 



Configuring the Emulator 4-1 



These commands are covered in the examples presented in earlier 
manual chapters; they are also covered in the HP 64700 Terminal 
Interface: User's Reference manual. 



Coordinated 
Measurements 



These commands determine how the emulator interacts with other 
measurement instruments, such as external analyzers, or other HP 
64700 emulators connected via the CMB (Coordinated Measurement 
Bus). 

These commands are covered in the HP 64700 CMB User's Guide and 
in the HP 64700 Terminal Interface: User's Reference manual. 



Analyzer The analyzer configuration commands are those commands which 
actually specify what type of measurement the analyzer is to make. 

Some of the analyzer commands are covered earlier in this manual. 
You can also refer to the HP 64700 Terminal Interface: Analyzer 
User's Guide and the HP 64700 Terminal Interface: User's Reference 
manual. 



System This last group of commands is used by you to set the emulator' s data 
communications protocol, load or dump contents of emulation 
memory, set up command macros, and so on. 

These commands are covered earlier in this manual and in the manual 
titled HP 64700 Terminal Interface: User's Reference manual. 
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Emulation As noted before, these commands determine how the emulation 

PrOCGSSOT tO processor will interact with the emulator's memory and the target 

S y Stem during an emulation measurement. 

Emulator/Target 
System 



Cf The cf command defines how the emulation processor will respond to 
certain target system signals. It also defines the type of emulation 
monitor to be used and optionally defines the location of that monitor 
in emulation memory. 

To see the default configuration settings defined by the cf command, 
type: 

M> cf 
You will see: 



cf chip=7702M2 

cf isf r=0 . . 07f 

cf iram=080 . .21 t 

cf irom=0c000 . . Of f f f 

cf ipmr=05e 

cf mode=single 

cf mon=bg 

cf clk=int 

cf int=en 

cf rdy=dis 

cf rush=dis 

cf wdog=dis 

cf rsp=27f 

cf rrt=dis 

cf dmdt=dis 

cf tdma=dis 

cf trfsh=dis 

cf thold=dis 



Let's examine each of these emulator configuration options, with a 
view towards how they affect the processor's interaction with the 
emulator. 
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cf chip 



The chip configuration item defines the chip you emulate. This 
command looks a prepared table, and set up the isfr, iram, irom and 
rsp configuration items. The rsp configuration item is set to the end of 
internal RAM area. 

M> cf chip=<chip_name> 

Processors supported by this command and their <chip_name> are 
listed in Processor Support List for HP MELPS emulators. 

M> cf chip=other 

You need to select "other" for this item, if your processor is listed in the 
Processor Support List for HP MELPS emulators but is not found in ? 
cf chip command. In this case, you should set up proper value for cf 
isfr, cf iram, cf irom, cf ipmr, and cf rsp by yourself. 



Note 




Executing this command will drive the emulator into the reset state. 



cf isfr 

The isfr (internal Special Function Register: SFR) configuration item 
defines the location of SFR area. 



Note 4jl This item is automatically set up by cf chip command. Therefore, you 

don't have to set up this item when your processor can be specified by 
cf chip command. If your processor is not supported by cf chip 
command (when you select "other" for the configuration item), you 
need to set up proper value for cf isfr command. 



M> cf isf r=<address> . . <address> 
[,<address>. .<address>] 

You can specify the start address and end address of SFR area by above 
command. The start address and end address of this area can be 
defined on 16 byte boundaries. 

M> cf isfr=none 
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When there is no SFR in your processor, you should select "none" to 
this configuration item. 



Executing this command will drive the emulator into the reset state. 



cf iram 

The iram (internal RAM) configuration item defines the location of 
internal RAM area. 



This item is automatically set up by cf chip command. Therefore, you 
don't have to set up this item when your processor can be specified by 
cf chip command. If your processor is not supported by cf chip 
command (when you select "other" for the configuration item), you 
need to set up proper value for cf iram command. 



M> cf iram=<address> . . <address> 
[ , <address> . . <address>] 

You can specify the start address and end address of internal RAM area 
by above command. The start address and end address can be defined 
on 16 byte boundaries. 

M> cf iram=none 

When there is no internal RAM in your processor, you should select 
"none" to this configuration item. 



Executing this command will drive the emulator into the reset state. 
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cf irom 



The irom (internal ROM) configuration item defines the location of 
internal ROM area. 



Note 9p This item is automatically set up by cf chip command. Therefore, you 

don't have to set up this item when your processor can be specified by 
cf chip command. If your processor is not supported by cf chip 
command (when you select "other" for the configuration item), you 
need to set up proper value for cf irom command. 



M> cf irom=<address> . . <address> 

You can specify the start address and end address of internal ROM area 
by above command. The start address and end address can be defined 
on 16 byte boundaries. 

M> cf irom=none 

When there is no internal ROM in your processor, you should select 
"none" to this configuration item. 



Note 




Executing this command will drive the emulator into the reset state. 



cf ipmr 

The ipmr (processor mode register) configuration item defines the 
location of the processor mode register. 



Note Ma This item is automatically set up by cf chip command. Therefore, you 

™ don't have to set up this item when your processor can be specified by 

cf chip command. If your processor is not supported by cf chip 
command (when you select "other" for the configuration item), you 
need to set up proper value for cf ipmr command. 
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M> cf ipmr=<address> 

You can specify the address of processor mode register by above 
command. 



This configuration item is needed to manage the processor mode. Note 
that the address is correctly specified, when you set up this 
configuration item by yourself. 



Executing this command will drive the emulator into the reset state. 



cf mode 

The mode (cpu operation mode) configuration item defines operation 
mode of the processor and data bus width. 

M> cf mode=<mode> 

Valid <mode> are following: 

<mode> Description 

single The emulator will operate in single chip mode. 

ext8 The emulator will operate in memory expansion 

mode with 8 bits external data bus width. 

extl6 The emulator will operate in memory expansion 

mode with 16 bits external data bus width. 

proc8 The emulator will operate in microprocessor mode 

with 8 bits external data bus width. 

proc 16 The emulator will operate in microprocessor mode 

with 16 bits external data bus width. 
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Note 



You may need to set up a switch inside the emulation pod in addition to 
this configuration. Refer to the manual provided with your emulation 
pod. 



Note 




Executing this command will drive the emulator into the reset state. 



cf mon 

The mon (monitor) configuration item allows you to choose between a 
foreground monitor supplied by you or the background monitor 
supplied with the emulator. 

The emulation monitor is the program that handles communication 
between the emulation controller and the emulation processor. For 
example, when you ask for a register display, the processor is broken to 
the monitor, executes some code to store its register contents in an 
array of memory locations, then returns to executing your program. 

The background monitor provided with the emulator offers the greatest 
degree of transparency to your target system (that is, your target system 
should generally be unaffected by monitor execution). However, in 
some cases you may require an emulation monitor tailored to the 
requirements of your system. In this case, you will need to use a 
foreground monitor linked into your program modules. See Appendix 
A of this manual for more information on foreground monitors. 

M> cf mon=bg 

You select the use of the built-in background monitor through the 
above command. A memory overlay is created and the background 
monitor is loaded into that area. 

M> cf mon=fg. .XXXX 

You select the use of your foreground monitor using this command. 
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XXXX defines an 16 bits hex address where the monitor will be 
located. (Note: this will not load the monitor, it only specifies its 
location). You can define the location on a 2K byte boundary (address 
ending in 000 hex or 800 hex). You can not locate the monitor at 
internal RAM area or Special Function Register area. 

Remember that you must assemble and link your foreground monitor 
starting at the 2K byte boundary specified in the command above. You 
must also load the monitor into emulation memory. 



If you intend to use a foreground monitor, the monitor must be loaded 
before attempting to load any information into target system memory. 



A memory mapper term is automatically created when you execute the 
cf mon=fg command to reserve 2K bytes of memory space for the 
foreground monitor. 

The memory map is reset any time cf mon=fg is entered. It is only 
reset when cf mon=bg if the emulator is not already configured to use 
the background monitor. 



Executing this command will drive the emulator into the reset state. 



cf elk 

The elk (clock) option allows you to select whether the emulation 
processor's clock will be sourced by your target system or by the 
emulation pod. 

M> cf clk=int 

You can select the emulator's internal clock using the above command. 
The clock is provided from the circuit in the emulation pod. In the case 
of HP 64146-61002 emulation pod, the internal clock speed is 
1/8/16/25 MHz. When you use an emulation pod with clock faster than 
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16 MHz, you need to enable the cf rush configuration or insert one 
wait state. 

M> cf clk=ext 

You can specify that the emulator should use the clock input to the 
emulator probe from the target system as the system clock. The HP 
64 147 A 7750/51 emulator can only operate rightly with clock input 
from 1 up to 25MHz. And you must use a clock input conforming to 
the specifications for the 7750/5 1 Series microprocessor. When clock 
is faster than 16 MHz, you need to enable the cf rush configuration or 
insert one wait state. 



Note Ha You can insert a wait state with one of the following methods. 

3* ■ PrnvirHna the /RDY from the tnrtrpt svstpm 



Providing the /RDY from the target system. 
Configuring the emulator to generate the /RDY signal. Refer 
to the section describing the cf rdy command 



Note Rja When the external clock is selected, your target system must have a 

*W clock generation circuit. The emulation pod cannot generate clock 
signal using a ceramic (or quartz crystal) resonator. 



Note 




Executing this command will drive the emulator into the reset state. 



cf int 

The int configuration item determines whether or not the emulator 
responds to interrupt signals from the target system during foreground 
operation. 

M> cf int=en 

Using the above command, you can specify that the emulator will 
respond to interrupts from the target system. 
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M> cf int=dis 

The emulator won't respond to interrupts from the target system. 

If you are using the background monitor, the emulator does not accept 
any interrupt during background execution. Edge sensed interrupts 
occurred during in background is latched only the last one, and this 
interrupt will occur when context is changed to foreground. Level 
sensed interrupts are ignored during in background operation. 



You may need to set up switches inside the pod to accept interrupts 
from the target system. Refer to the manual provided with your 
emulation pod. 



Executing this command will drive the emulator into the reset state. 



cf rdy 

The rdy configuration item defines whether or not the emulator 
introduces /RDY input when it accesses any memory. This feature is 
used to run the emulator with clock faster than 16 MHz. 

M> cf rdy=dis 

You can disable the /RDY input by the emulator with above command. 
When clock is equal or slower than 16 MHz, always use the emulator 
with cf rdy=dis. 

M> cf rdy=en 

When enabled, the emulator activate /RDY input for one clock cycle, 
every time the emulator accesses memory. 



Executing this command will drive the emulator into the reset state. 



Configuring the Emulator 4-11 



cf rush 



The rush configuration item enables/disables the high speed access 
mode of the emulator. 

M> cf rush=dis 

You can disable the high speed access mode with the above command. 

When you disable the high speed access mode: 

■ You can define up to 16 different map terms which can be 
placed wherever you like. (Refer to the "Memory Mapping" 
section in this chapter.) 

■ The emulator can run with no wait state, up to 16 MHz. 

■ The emulator can run with one wait state, up to 25 MHz. 
M> cf rush=en 

You can enable the high speed access mode with the above command. 

When you enable the high speed access mode: 

■ The emulator can access emulation memory with no wait 
state, up to 25 MHz. 

■ You can map the emulation memory only to the following 
location. 



Memory 


Monitor 


Available location 


128K 


Background 


000000-01F7FF 


128K 


Foreground 


000000-01FFFF 


512K 


Background 


000000-07F7FF 


512K 


Foreground 


000000-07FFFF 


1M 


Background 


000000-0FF7FF 


1M 


Foreground 


000000-OFFFFF 


2M 


Background 


000000-1FF7FF 


2M 


Foreground 


000000- 1FFFFF 



cf wdog 

The wdog (watch dog timer) configuration item defines whether the 
watch dog timer is enabled or not. 

M> cf wdog=dis 

You can disable the watch dog timer with above command. 
M> cf wdog=en 
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You can enable the watch dog timer with above command, 
cf rsp 

The rsp (reset stack pointer) configuration item allows you to specify a 
value to which the stack pointer and stack page register will be set upon 
the transition from emulation reset into the emulation monitor. 



This item is automatically set up by cf chip command. The cf chip 
command set up rsp to the end of internal RAM. When you select a 
processor which has no internal RAM, rsp is set to FFF hex. 



R> cf rsp=XXXX 

where XXXX is a 16 bits address, will set the stack pointer to that 
value upon entry to the emulation monitor after an emulation reset. 
When the emulator breaks to the background monitor, the monitor 
program needs 5 bytes of stack. 

For example, to set the stack pointer to 27f hex, type: 
R> cf rsp=27f 

Now, if you break the emulator to monitor using the b command, the 
stack pointer will be modified to the value 27f hex. 



Without a stack pointer, the emulator is unable to make the transition to 
the run state, step, or perform many other emulation functions. 
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cf rrt 



The rrt (restrict to real time) option lets you configure the emulator so 
that commands which cause the emulator to break to monitor and 
return to the user program will be rejected by the emulator command 
interpreter. 

M> cf rrt=en 

You can restrict the emulator to accepting only commands which don't 
cause temporary breaks to the monitor by entering the above command. 
Only the following emulator run/stop commands will be accepted: 

rst (resets emulation processor) 

b (breaks processor to background monitor until you enter another 
command) 

r (runs the emulation processor from a given location) 

s (steps the processor through a piece of code — returns to monitor after 
each step) 

Commands which cause the emulator to break to the monitor and 
return, such as reg, m (for target memory display), and others will be 
rejected by the emulator. 



If your target system circuitry is dependent on constant execution of 
program code, you should set this option to cf rrt=en. This will help 
insure that target system damage doesn't occur. However, remember 
that you can still execute the rst, b and s commands; you should use 
caution in executing these commands. 



M> cf rrt=dis 

When you use this command, all commands, regardless of whether or 
not they require a break to the emulation monitor, are accepted by the 
emulator. 

cf dmdt 

This configuration item is reserved for use by the Softkey Interface. 
4-14 Configuring the Emulator 



Caution 



cf tdma 

The tdma (trace DMA cycles) configuration item defines whether or 
not the emulator traces DMA cycles. 

M> cf tdma=en 

When you enable this item with the above command, each time DMA 
performed, one emulation analyzer state will be generated to recognize 
the DMA cycle. 

M> cf tdma=dis 

When disabled, no analyzer state will be generated at the occurrence of 
DMA. Therefore, any DMA cycle will be ignored by the analyzer. 

cf trfsh 

The trfsh (trace bus release cycles) configuration item defines whether 
or not the emulator traces refresh cycles. 

M> cf trfsh=en 

When you enable this item with the above command, refresh cycles are 
traced by the emulation analyzer. 

M> cf trfsh=dis 

When disabled, refresh cycles are not traced by the analyzer. 

cf thold 

The thold (trace hold cycles) configuration item defines whether or not 
the emulator traces hold cycles. 

M> cf thold=en 

When you enable this item with the above command, the emulation 
analyzer will trace hold cycles. 

M> cf thold=dis 

When disabled, hold cycles are not traced by the emulation analyzer. 

Memory Mapping Before you begin an emulator session, you must specify the location 

and type of various memory regions used by your programs and your 
target system (whether or not it exists). You do this for several reasons: 
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■ the emulator must know whether a given memory location 
resides in emulation memory or in target system memory. This 
allows the emulator to properly orient buffers for the given 
data transfer. 



■ the emulator needs to know the size of any emulation memory 
blocks so it can properly reserve emulation memory space for 
those blocks. 



■ the emulator must know if a given space is RAM (read/write), 
ROM (read only), or doesn't exist. This allows the emulator to 
determine if certain actions taken by the emulation processor 
are proper for the memory type being accessed. For example, 
if the processor tries to write to a emulation memory location 
mapped as ROM, the emulator will not permit the write (even 
if the memory at the given location is actually RAM). (You 
can optionally configure the emulator to break to the monitor 
upon such occurrence with the be -e rom command.) Also, if 
the emulation processor attempts to access a non existent 
location (known as "guarded"), the emulator will break to the 
monitor. 

You use the map command to define memory ranges and types for the 
emulator. The HP 64147A 7750/51 Series emulator memory mapper 
allows you to define up to 16 different map terms; each map term has a 
minimum size of 256 bytes. If you specify a value less than 256 byte, 
the emulator will automatically allocate an entire block. You can 
specify one of five different memory types (erom, eram, trom, tram, 
grd). 
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For example, you might be developing a system with the following 
characteristics: 



■ input port at 500 hex 

■ output port at 580 hex 

■ program and data in external ROM from cOOO through 
dfffhex 

Suppose that the only thing that exists in your target system at this time 
are input and output ports and some control logic; no memory is 
available. You can reflect this by mapping the I/O ports to target 
system memory space and the rest of memory to emulation memory 
space. Type the following commands: 

R> map -d * 

R> map 500.. 580 tram 

R> map 0c000..0dfff erom 

R> map 

# remaining number of terms : 14 

# remaining emulation memory : 7df00h bytes 
map 0000500 .. 00005ff tram # term 1 

map 000C000 . . OOdf f f eram # term 2 
map other tram 

As you can see, the mapper rounded up the second term to 256 bytes 
block, since those are minimum size blocks supported by the HP 
64 147 A 7750/51 Series emulator. 



Note When you use background monitor, the emulator occupies 2K byte, 

which is used for background monitor program, leaving 122K, 506K, 
1018K, 2042K byte of emulation memory which you may use. 



Note 




When you emulate the internal ROM area, you must map the address 
to emulation memory. 
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Note 



You cannot map internal RAM and SFR as guarded (grd). 



Note You should map all memory ranges used by your programs before 

loading programs into memory. This helps safeguard against loads 
which accidentally overwrite earlier loads if you follow a map/load 
procedure for each memory range. 



Internal RAM and SFR 

The emulator uses internal RAM of emulation processor to emulate 
user program. When you direct the emulator to display the contents of 
internal RAM (or SFR) area, the emulator breaks to the monitor and the 
monitor program reads the contents of memory. Therefore, execution 
of user program is suspended to perform your direction. However, you 
can configure the emulator so that write cycles are performed to both 
internal RAM (or SFR) and emulation memory. In this case, you can 
see the data written to emulation memory without suspending program 
execution. 

To use this feature, you need to map these area to emulation RAM 
(eram). When you do this, you can display the contents of emulation 
memory with m command without suspending user program execution. 
You still can display the contents of internal RAM by appending "@i" 
to address specification in m command. 

For example, to see the content of address 100 hex in internal RAM, 
you can do both of the following: 

M> m 100 (This command accesses emulation 
memory) 

M> m 100@i (This command accesses internal 
RAM of emulation processor.) 

When you don't map the internal RAM and SFR area to emulation 
RAM, you can access the internal RAM and SFR without appending 
"@i". 
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Note Ma The contents of emulation memory is updated only when user program 

writes data to internal RAM or SFR. Therefore, the contents of 
emulation memory may be different from the actual value of internal 
RAM or SFR. Especially, you should pay a close attention when 
seeing flags of SFR. 



Note When you modify memory, the emulator breaks to the monitor, and 

writes data to internal RAM or SFR. Therefore, user program is 
suspended when modifying internal RAM or SFR. 



For further information on mapping, refer to the examples in earlier 
chapters of this manual and to the HP 64700 Terminal Interface User's 
Reference manual. 

Break Conditions The be command lets you configure the emulator's response to various 

emulation system and external events. 

Write to ROM 

If you want the emulator to break into the emulation monitor whenever 
the user program attempts to write to a memory region mapped as 
ROM, enter: 

M> be -e rom 

You can disable this function by entering: 
M> be -d rom 

When disabled, the emulator will not break to the monitor upon a write 
to ROM; however, it will not modify the memory location if the 
memory at that location is actually RAM. 
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Software Breakpoints 



The bp command allows you to insert software traps in your code 
which will cause a break to the emulation monitor when encountered 
during program execution. If you want to enable the insertion and use 
of software breakpoints by the bp command, enter: 

M> be -e bp 

To disable use of software breakpoints, type: 
M> be -d bp 

Any breakpoints which previously existed in memory are disabled, but 
are not removed from the breakpoint table. 

Trigger Signals 

The HP 64700 emulator provides four different trigger signals which 
allow you to selectively start or stop measurements depending on the 
signal state. These are the bnct (rear panel BNC input), cmbt (CMB 
trigger input), trigl and trig2 signals (provided by the analyzer). 

You can configure the emulator to break to the monitor upon receipt of 
any of these signals. Simply type: 

M> be -e <signal> 

For example, to have the emulator break to monitor upon receipt of the 
trigl signal from the analyzer, type: 

M> be -e trigl 

(Note: in this situation, you must also configure the analyzer to drive 
the trigl signal upon finding its trigger by entering tgout trigl). 
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Limitations and 
Considerations 



Clock Speed 

Access to Internal 
RAM 

Trace Internal RAM 
Note q£ 

Step Command to 
Internal RAM 

DMA Support 

Watch Dog Timer in 
Background 

Step Command with 
Foreground Monitor 



Maximum clock speed of HP 64 147 A 7750/51 emulator is 25MHz. 
This emulator does not support any operation with clock faster than 
25MHz. 

Modifying internal RAM or SFR suspends user program execution. 



Read data from the internal RAM or SFR is not traced correctly by the 
emulation analyzer. 



Write data is also not traced correctly, when the following conditions 
are met: 

■ The emulator is used with the M37780/81/82/83/85/95/96 
emulation pod. 

■ The processor is operating in the memory expansion or 
microprocessor mode with 8 bit external bus. 



Step command to internal RAM area is not available. 



Direct memory access to emulation memory is not allowed. 



Watch dog timer suspends count down while the emulator is running in 
background monitor. 



Step command is not available when the emulator is used with a 
foreground monitor. 
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Step Command and 
Interrupts 



When an interrupt occurs while the emulator is running in monitor, the 
emulator fails to do the first step operation. The emulator will display 
the mnemonic of the instruction which should be stepped, but the 
instruction is not actually executed. The second step operation will 
step the first instruction of the interrupt routine. 



Emulation 
Commands in 
Stop/Wait Mode 



When the microprocessor is in the stop or wait mode, emulation 
commands which access memory or registers will fail. In the case of 
using M37782/83/85 emulation pod, you need to reset the emulator to 
release stop or wait mode. And, in the case of using other emulation 
pod, you need to break the the emulator. 



RDY/HOLD Input in 
Background Cycles 



The 64147A M37750/51 emulator does not accept RDY/HOLD input 
while in background monitor. However, when you use 
M37780/8 1/82/83/85/95/96 emulation pod, M37750/51 emulator 
accept RDY/HOLD input while in background monitor. 



Accessing External When operation mode is memory expansion or microprocessor mode, 
Memory Area in SFR mere i s external memory area in SFR. However, accessing to this area 

is not allowed. 



High Speed BUS Always set bus mode as low speed bus mode, when you use M37751 
Mode emulation pod. HP 64147A 7750/5 1 emulator does not support high 
speed bus mode. Note that bus mode is automatically configured as 
high speed bus mode when you do r rst(run from target reset). Then, 
you need to re-configure bus mode as low speed bus mode before 
accessing SFR area. 



RMPA Instruction Disassembling in trace list may not be correct for next instruction of 

RMPA instruction. This failure will occur when RMPA instruction is 
repeated over about fifty times. 



Stack Address in some versions of 7720 microprocessor, the stack can be located in 
Bank FF. However, the HP 64147A 7750/51 Series emulator doesn't 
support the feature. The stack must be located in Bank 0. 



Evaluation Chip Hewlett-Packard makes no warranty of the problem caused by the 

Evaluation chip in the emulator. 
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A 



Using the Optional Foreground Monitor 



By using and modifying the optional Foreground Monitor, you can 
provide an emulation environment which is customized to the needs of 
a particular target system. 



Comparison of An emulation monitor is required to service certain requests for 

Pq^qq |«Qjj f| £| information about the target system and the emulation processor. For 

** example, when you request a register display, the emulation processor 

Background is forced into the monitor. The monitor code has the processor dump 

Monitors * tS re S* sters mt0 certam emulation memory locations, which can then be 

read by the emulator system controller without further interference. 



Backg rOU nd A background monitor is an emulation monitor which overlays the 
Monitors processor's memory space with a separate memory region. Entry into 
the monitor is normally accomplished by jamming the monitor 
addresses onto the processor's address bus. 

Usually, a background monitor will be easier to work with in starting a 
new design. The monitor is immediately available upon powerup, and 
you don't have to worry about linking in the monitor code or allocating 
space for the monitor to use the emulator. No assumptions are made 
about the target system environment; therefore, you can test and debug 
hardware before any target system code has been written. All of the 
processor's address space is available for target system use, since the 
monitor memory is overlaid on processor memory, rather than 
subtracted from processor memory. Processor resources such as 
interrupts are not taken by the background monitor. 

However, all background monitors sacrifice some level of support for 
the target system. For example, when the emulation processor enters 
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the monitor code to display registers, it will not respond to target 
system interrupt requests. This may pose serious problems for complex 
applications that rely on the microprocessor for real-time, non-intrusive 
support. Also, the background monitor code resides in emulator 
firmware and can't be modified to handle special conditions. 

Foreground Monitors K foreground monitor may be required for more complex debugging 

and integration applications. A foreground monitor is a block of code 
that runs in the same memory space as your program. You link this 
monitor with your code so that when control is passed to your program, 
the emulator can still service real-time events, such as interrupts or 
watchdog timers. For most multitasking, interrupt intensive 
applications, you will need to use a foreground monitor. 

You can tailor the foreground monitor to meet your needs, such as 
servicing target system interrupts. However, the foreground monitor 
does use part of the processor's address space, which may cause 
problems in some target systems. You must also properly configure the 
emulator to use a foreground monitor (see Chapter 4 and the examples 
in this appendix); and, you must link the monitor with your other 
program code. 
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An Example Using 
the Foreground 
Monitor 



In the following example, we will illustrate how to link a foreground 
monitor with the sample program from Chapter 2. By using the 
emulation analyzer, we will also show how the emulator switches from 
state to state using a foreground monitor. 



Note Ma Two foreground monitor programs are provided with HP 64 147 A 

W 7750/5 1 emulator. fm7750.a77 is written for Mitsubishi RASM77 
Assembler, and fm7750.src is for MRI ASMM77 Assembler. 



Modify Location 
Declaration 
Statement 

Monitor Address 

To use the monitor, you may need to modify the .EQU statement just 
after the first comment section of the monitor program listing. You 
should see the line below: 

LOCATE_ADRS . EQU 0B800H ; start monitor on 2k boundary in bank 0 

; rather than sfr/iram area 
PROCMODEREG . EQU 0005EH processor mode register's address 

You can specify the monitor location by modifying this label 
LOCATE_ADRS. For example, if you want locate the monitor 
program at aOOO hex, make above line to as below: 

LOCATE_ADRS .EQU 0A000H ; start monitor on 2k boundary in bank 0 

; rather than sfr/iram area 
PROCMODEREG .EQU 0005EH processor mode register's address 



You can load the foreground monitor on a 2k byte boundary of bank 0 
(except internal RAM area and SFR area). In this example, we will 
locate the monitor at b800 hex. Therefore, you don't have to modify the 
LOCATE_ADRS label. 
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Processor Mode Register Address 

You may need to modify the .EQU statement at the PROCMODEREG 
label. This value defines the location of processor mode register. If 
your processor has processor mode register at address other than 5e 
hex, modify this value to appropriate value. 

Modify Chip Name 
Statement 



CHIP7751 



CHIP7751 



.WORD 



.WORD 



Chip Name 

To use the monitor with 775 1 microprocessor, you need to modify the 
chip name section of foreground monitor. Default setting is following. 

OTHER_THAN_7751 

You can specify 775 1 microprocessor by modifying this section like 
below. 

7751 



Configure the Before configuring the emulator, you should initialize the emulator to a 
Emulator known state. Type: 



R> init 

Select processor you are going to emulate. Type: 
R> cf chip=<chip_name> 

You need to tell the emulator that you will be using a foreground 
monitor and allocate the memory space for the monitor. This is all 
done with one configuration command. To locate the monitor on a 2k 
boundary starting at b800 hex, type: 

R> cf mon=fg. . 0b800 

To see the new memory mapper term allocated for the foreground 
monitor, type: 

R> map 



# remaining number of terms : 15 

# remaining emulation memory : 7f800h bytes 
map 000b800 . . OOObf f f eram # term 1 

map other tram 



Notice that a 2k byte block from b800 through bfff hex was mapped. 
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Now, you need to map memory space for the sample program. Type: 
R> map OcOOO . . Odfff erom 

If you are going to emulate a processor which has no internal RAM, 
map 100 hex through 2ff hex as emulation RAM. 

Set 3 Stack Pointer You need to set up the stack pointer for use by the foreground monitor. 

The foreground monitor use the stack when transit from foreground 
monitor to user program. You can use the cf rsp command to define 
the stack pointer location; the stack pointer will be initialized on each 
transition from emulation reset to the monitor. Type: 

R> cf rsp=27f 

Load the Program Now it's time to load the sample program and monitor. Assemble and 
Code link the monitor program. 

In the example shown, we're loading the program from a host with the 
emulator in Transparent Configuration. If you're using the standalone 
configuration with a data terminal, you will need to enter the data using 
the m command. (You can get the data from your assembly listings.) 
See Chapter 2 for information. 

Load the sample program by typing: 

R> load -ios "cat cmd_rds .hex" 

Load the monitor program by typing: 

R> load -ios "cat fm7750.hex" 

Before we forget, let's initialize the stack pointer by breaking the 
emulator out of reset: 

R> b 

Now you can run the sample program. 
M> r OcOOOO 
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Limitations of 

Foreground 

Monitors 

Step Command Step command (s command) is not available when you are using the 

foreground monitor. 

cim Command cim command is not available when you are using the foreground 
monitor. 

Synchronized You cannot perform synchronized measurements over the CMB when 
measurements using a foreground monitor. If you need to make such measurements, 
set the foreground/background configuration option to cf mon=bg. 
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B 



7750/51 Series Emulator Specific Command 
Syntax 



The following pages contain descriptions of command syntax specific 
to the 64147A 7750/51 Series emulator. The following syntax items 
are included (several items are part of other command syntax): 

■ <CONFIG_ITEMS>. May be specified in the cf (emulator 
configuration) and help cf commands. 

■ <DISPLAY_MODE>. May be specified in the mo (display 
and access mode), m (memory), and ser (search memory for 
data) commands. The display mode is used when memory 
locations are displayed or modified. 

■ <ADDRESS>. May be specified in emulation commands 
which allow addresses to be entered. 

■ <REG_NAME>. May be specified in the reg (register) 
command. 
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CONFIGJTEMS 

Summary 7750/51 Series emulator configuration items. 




B-2 Specific Command Syntax 



DeSCri ptiOll The 64147A 7750/5 1 Series emulator has several dedicated 

configuration items which allow you to specify the emulator's 
interaction with the target system and the rest of the emulation system. 
These items are: 



chip Select chip to be emulated. 

isfr Define the location of Special Function Register. 

iram Define the location of internal RAM. 

irom Define the location of internal ROM. 

ipmr Define the address of processor mode register 

mode Select operation mode of the processor. 

rush Enable/disable high speed access mode. 

mon Select background or foreground monitor. 

elk Select internal/external clock source. 

int Enable/disable interrupts from target system. 

rdy Enable/disable /RDY input by the emulator. 

wdog Enable/disable the Watch Dog Timer. 

rsp Specify reset value of the stack pointer. 

rrt Restrict emulator to real time runs 

tdma Enable/disable tracing DMA cycles. 

trfsh Enable/disable tracing refresh cycles. 

thold Enable/disable tracing hold cycles. 



Complete explanations of all configuration items are given in chapter 4 
of this manual. 
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Examples 



To select an external clock, type: 



M> cf clk=ext 

You can obtain the status of configuration items by typing the item 
name without a value. You can also specify multiple configuration 
items on the same line. Type: 

M> cf mon=fg. . 08000 rrt=dis elk 

cf clk=int 

Here, we changed to a foreground monitor located at address 8000 hex, 
disabled the real-time runs restriction, and ask processor clock source. 
Notice that items which are changed do not have status printed; you 
could explicitly request the new status by repeating the configuration 
item on the command line after the change but without a value. For 
example: 

R> cf mon=fg. . 2000 mon 

cf mon=fg. .2000 

Related information Refer to the cf syntax pages in the User's Reference manual. Also, 

refer to chapter 4 of this manual for complete information about each 
configuration item. 
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DISPLAYMODE 

S U m m a ry Specify the memory display mode 



Syntax — y^OED 




DeSCri ptiOll The <DISPLAY_MODE> specifies the format of the memory display 
or the size of the memory which gets changed when memory is 
modified. 

b Byte. Memory is displayed in a byte format, and 

when memory locations are modified, bytes are 
changed. 



w 



Word. Memory is displayed in a word format, and 
when memory locations are modified, words are 
changed. 



m 



Mnemonic. Memory is displayed in mnemonic 
format; that is, the contents of memory locations are 
inverse-assembled into mnemonics and operands. 
When memory locations are modified, the last 
non-mnemonic display mode specification is used. 
You cannot specify this display mode in the ser 
(search memory for data) command. 



Def ail ItS The <DIPLAY_MODE> is b at power up initialization. Display mode 
specifications are saved; that is, when a command changes the display 
mode, the new display mode becomes the current default. 



Related Information Refer to the mo syntax information in the Terminal Interface Reference 

manual for more details on mode command. 
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ACCESS_MODE 

S U m m a ry Specify the memory access mode 



Syntax 





DeSCfi ptiOfl Access mode defines how the emulator accesses target system memory. 

The 64147A 7750/51 Series emulator allows the following access 
modes: 

b - byte access mode 
w - word access mode 

The emulator monitor uses the access mode to determine whether to 
use byte or word instructions during target system memory accesses, 
such as memory modification or display, (note that it does not affect 
how that data is displayed on screen, which is controlled by the display 
mode.) 



Def ail ItS The <ACCESS_MODE> is b at power up initialization. Display mode 
specification are saved; that is, when a command changes the access 
mode, the new access mode becomes the current default. 

Related Information Refer to the mo syntax information in the Terminal Interface Reference 

manual for more details on mode command. 
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ADDRESS 



S U m m a ry Address specification used in emulation commands. 



DeSCN ptiOII The <ADDRESS> parameter used in emulation commands is specified 
in 24 bits address information. 



The @i specification is needed to access internal RAM or SFR when 
you map these area to emulation RAM. When you map these area to 
emulation RAM, data write cycles are performed to both internal RAM 
(or SFR) and emulation memory. Therefore, you can display the data 
written to emulation memory without suspending user program 
execution. To display internal RAM or SFR, you need to specify @i 
after address expression. 

When you don't map internal RAM and SFR to emulation memory, 
you can access the actual RAM or SFR without specifying @i after 
address expression. 



Syntax 




Examples 



mlOOO 

m 20000..200ff 
m 100=41 
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REGISTERS 

Summary 



7750/51 Series register designators. 



<REG NAME> 



Related Commands 



Following registers are available: 



pg 


Program Bank Register 


pc 


Program Counter 


ps 


Processor Status Register 


dt 


Data Bank Register 


sp 


Stack Pointer 


a 


Accumulator A 


b 


Accumulator B 


X 


Index Register X 


y 


Index Register Y 


dpr 


Direct Page Register 



reg (register display/modify) 
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mx Command 

Syntax 

Summary 




< RETURN) 



The 7750/5 1 Series microprocessors have M flag and X flag which 
determine data length and index register length. The inverse assembler 
of emulator needs to know the value of these flags to disassemble the 
memory contents. The mx command tells the emulator the value of M 
flag and/or X flag. 

The -c option can be specified to set the current value of M and X flag 
in processor status register. 
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Notes 
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Index 



A adaptor 3-4 

ADDRESS syntax B-7 
Analyzer 

configuration 2-24 

halting 2-26 

pipeline 2-26 

predefined status equates 2-27 
restrictions 2-31 
storage specification 2-24 
trace list display 2-25 
trace list format 2-25 
triggering the 2-24 
Analyzer trace 
starting 2-25 

B b Command 2-20 

Background monitor A-l 

be Command 2-10, 2-28, 4-19 

Before using the emulator 2-2 

bp Command 4-20 

Break 

write to ROM 4-19 
Break condition 2-28 
break conditions 

after initialization 2-8 
breakpoints 2-8 

C cf chip Command 4-4 
cf Command 2-9 
cf ipmr Command 4-6 
cf iram Command 4-5 
cf irom Command 4-6 
cf isfr Command 4-4 
cf map Command 4-12 
cf mode Command 4-7 
cf rdy command 4-11 
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cf thold Command 4-15 
cf trfsh Command 4-15 
cfchip Command 2-9 
cim Command 2-28 
clock 

internal clock 4-10 
Comfiguration 

enable/disable mapper 4-12 
Command prompts 2-19 
Commandhelp 2-6 
Commands 

b2-20 

be 2-10, 2-28, 4-19 

bp 2-27, 4-20 

ci 2-9 

cf chip 2-9 

cf map 4-12 

cf rdy 4-11 

cfrsp4-13 

cf thold 4-15 

cf trfsh 4-15 

cim 2-28 

configuration 4-1 

cov 2-30 

equ 2-27 

help 2-6 

m 2-13, 2-21 

map 2-12, 4-16 

measurement 4-1 

mx 2-17 

r2-20 

recalling 2-24 
reg 2-21 
rst2-19 
s2-22 
t2-25 
tf2-25 
tg2-24 
th 2-26 
tl 2-25 
tsto 2-24 
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xp 2-14 

Comparison of foreground/background monitors A-l 

CONFIGJTEMS syntax B-2 

Configuration 

analyzer 4-2 

breaks 4-19 

clock selection 4-9 

enable/disable target interrupts 4-10 

enable/disable to trace DMA cycles 4-15 

enable/disable to trace hold cycles 4-15 

enable/disable to trace refresh cycles 4-15 

for getting started 2-9 

introducing RDY input 4-11 

memory mapping 4-16 

processor to emulator/target system 4-3 

system 4-2 

types of 4-1 
Coordinated measurement commands 4-2 
cov Command 2-30 
Coverage measurement 2-30 

D Displaying 

configuration 4-3 
registers 2-21 
trace list 2-25 
DT register 4-15 

E emulation memory 

after initialization 2-8 

mapping internal RAM and SFR area 4-18 
Emulation pod 

ordering information 1-3 
Emulation processor 

ordering information 1-3 
Emulator 

configuration 2-9 

purpose 1-1 
emulator configuration 

after initialization 2-8 
Emulator features 

analyzer 1-4 

breakpoints 1-6 
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coverage measurements 1-6 
emulation memory 1-4 
foreground and background monitor 1-5 
processor reset control 1-6 
register display/modify 1-5 
restrict to real-time runs 1-6 
single-step processor 1-6 
Emulator limitations 1-7 

Access to Internal RAM 1-7 

accessing external memory in SFR area 1-8 

clock speed 1-7 

displaying memory 4-19 

DMA support 1-7 

emulation command fails in stop/wait mode 1-8 
high speed bus mode 1-8 
modify/display internal RAM 2-22 
RDY/HOLD input in background cycles 1-8 
RMPA instruction 1-8 
stack pointer 1-8 

step command to Interanl RAM 1-7 
step command with foreground monitor 1-7 
step fails when an interrupt exists 1-8 
trace internal RAM 1-7 
watch dog timer 1-7 

Emulator specific command syntax B-l 

equ Command 2-27 

es(emulator status) command 2-8 

evaluation chip 1-8, 4-22 

F Foreground monitor 

address requirements 4-9 

cim command is unavailable A-6 

defining chip name A-4 

defining monitor address A-3 

defining processor mode register address A-4 

limitations A-6 

s command is unavailable A-6 
Foreground monitors A-2 

example of using A-3 
Function codes 

memory mapping 4-16 
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H Halting the analyzer 2-26 
Help 2-6 

help information on system prompts 2-7 

helpCommand 2-6 

high speed access mode 1-3 

high speed bus mode 1-8, 4-22 

Hold cycles 

enable/disable tracing hold cycles 4-15 

I Information help 2-6 

init (emulator initialization) command 2-8 
initialization, emulator 2-8 

warm start 2-8 
Installing target system probe 

target system probe 3-2 
internal RAM 4-18 

L limitations 

Access to Internal RAM 4-21 

accessing external memory in SFR area 4-22 

clock speed 4-21 

DMA support 4-21 

emulation command fails in stop/wait mode 4-22 

high speed bus mode 4-22 

RDY/HOLD input in background cycles 4-22 

RMPA instruction 4-22 

stack pointer 4-22 

step command to Interanl RAM 4-21 

step command with foreground monitor 4-21 

step fails when an interrupt exists 4-22 

trace internal RAM 4-21 

watch dog timer 4-21 
Loading programs 

for Transparent Configuration 2-14 

transfer utility 2-14 
Loadingprograms 2-13 

for Standalone Configuration 2-13 

M m Command 2-13 
mac Command 2-23 
macros 

after initialization 2-8 
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map Command 2-12, 4-16 
Memory Display 

mnemonic format 2-17 

setting up M flag andX flag 2-17 
memory map 

after initialization 2-8 
Memory mapping 4-16 

defining memory type to emulator 4-16 

for getting started program 2-12 

function codes 4-16 

internal ROM 4-17 

memory for monitor program 4-17 

sequence of map/load commands 4-18 
Memory search 2-29 
Mnemonic display format 2-17 
Monitor 

select foreground/background monitor 4-8 
monitor program 1-5 

background 1-5 

foreground 1-5 
Monitors 

background A-l 

comparison of foreground/background A-l 
mx Command 2-17 

N notes 

foreground monitor is written for RASM77 A-3 

P Prerequisites for using the emulator 2-2 

Program loads 2-13 

prompts 2-7 

emulator command 2-19 

help information on 2-7 

using "es" command to describe 2-8 

Purpose of the Emulator 1-1 

R r Command 2-20 
Refresh cycles 

enable/disable tracing refresh cycles 4-15 
reg Command 2-21 
Register Display 2-21 
REGISTERS syntax B-8 
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Restrict to real time runs 

permissible commands 4-14 

target system dependency 4-14 
Restrictions 

Analyzer 2-31 
rst Command 2-19 
run from reset 3-5 

S s Command 2-22 

unavailable with foreground monitor A-6 
Sample programs 

for getting started 2-3 
SFR4-18 

displaying without suspending user program 2-22 
Shrink DIP package 3-4 
single step 2-22 

disassembled mnemonic and mx command 2-23 

limitation 2-23 
software breakpoints 4-20 

after initialization 2-8 

defining in internal RAM 2-28 

defining in target ROM 2-28 
stack pointer 1-8, 4-22 
Starting a trace 2-25 
Storage qualifier 2-24 
supported microprocessors 1-3 

Syntax (command), specific to 7750/51 Series emulator B-l 

T t Command 2-25 

Target system dependency on executing code 4-14 
Target system probe 

cautions for installation 3-2 

installation 3-2 

installation procedure 3-3 
target system reset 

run from reset 3-5 
tf Command 2-25 
tg Command 2-24 
th Command 2-26 
tl Command 2-25 
Trace list display 2-25 
Trace list format 2-25 
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Tracing program execution 2-24 
Transfer utility 2-14 
Transparent mode 2-14 
Trigger signals 

break upon 4-20 
tsto Command 2-24 
Types of configuration 4-1 

W wait mode 1-8, 4-22 

warm start initialization 2-8 
watch dog imer 

enable/disable 4-12 

X xp Command 2-14 
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